Second argument to can_access_list is accidentally polymorphic in syntax

[In server/plugins/messages.py](https://github.com/apache/incubator-ponymail-foal/blob/f23c9ed887db8af2a6b9456f93f5460337369bdb/server/plugins/messages.py#L492-L495) the second argument to `plugins.aaa.can_access_list`, `listname`, is a List-Id:

```python3
private_lists_accessible = []
for listname in private_lists_found:
if plugins.aaa.can_access_list(session, listname):
private_lists_accessible.append(listname)
```

So it would e.g. receive ``.

But [in server/endpoints/preferences.py](https://github.com/apache/incubator-ponymail-foal/blob/f23c9ed887db8af2a6b9456f93f5460337369bdb/server/endpoints/preferences.py#L50-L52) the second argument, `ml`, is an email address:

```python3
can_access = True
if entry.get("private", True):
can_access = plugins.aaa.can_access_list(session, ml)
```

So it would e.g. receive `example@lists.example.com`.

Compare the two call sites in server/plugins/messages.py around lines 492-495 and server/endpoints/preferences.py around lines 50-52, then trace the definition of plugins.aaa.can_access_list. Determine the expected identifier format and update the affected call path consistently; done means both callers pass the form the access check expects and the relevant tests cover each input.

Written by the indexing model from the issue text.